docs / destinations / filesystem_gcs

Google Cloud Storage

deployable todayappend and replace only

Parquet files in your own GCS bucket. Ingest holds no credential: your runs authenticate with the AWS identity your workspace already has.

Ingest lands typed, deduplicated tables in Google Cloud Storage from any API it connects, including Abilene TX 311, Albany NY 311, Ann Arbor MI 311 and Anne Arundel County MD 311. You own the Google Cloud Storage account and the credentials; Ingest keeps no copy of the data.

Every destination receives the same layout; see the tables Ingest creates.

Setup

Before you start

You need an existing bucket and a Google Cloud administrator. Your administrator enables APIs, manages workload identity providers, and changes bucket IAM permissions. Ingest receives only the two bucket roles granted in step 3. No Google key is needed. Copy workspace-specific commands from the signed-in Ingest panel. Public docs show placeholders for Ingest's AWS account and role. In the signed-in panel, replace only your project ID and bucket name.

1. Choose your bucket

  • Open Google Cloud Welcome. Select your bucket's project in the top project picker; copy the Project ID shown under Welcome (e.g. acme-analytics-123456). Use the ID, not the project name or number.
  • In Cloud Storage → Buckets, copy your bucket's name (e.g. acme-data). Your Bucket and folder is gs://, that name, and a folder for your files, such as gs://acme-data/ingest.
  • Click Activate Cloud Shell. Run this command with your project ID and bucket filled in, and check the project. Authorize Cloud Shell if prompted. Keep the same terminal open for all three blocks. The Bucket and folder you enter above the command is saved with the destination; the project ID is used only by these commands and is not saved. On the public docs page, replace your-project-id and your-bucket (without gs://) yourself and keep the quotes.
INGEST_GCP_PROJECT="your-project-id"
INGEST_GCS_BUCKET="your-bucket"
gcloud projects describe "${INGEST_GCP_PROJECT}" \
  --format="table(projectId,name,projectNumber)"
  • Leave Format empty for parquet. Other values: jsonl.gz and csv.gz. Plain files do not support upserts.

2. Connect your workspace

  • Run in the same Cloud Shell. Google verifies your workspace's AWS role and issues short-lived tokens. The provider's condition limits access to this workspace.
  • Provider already exists? Have your administrator verify it before skipping its creation. A provider from this workspace's BigQuery setup can be reused if its project, AWS account, mapping, and condition match. Enable any missing APIs, but skip the two create commands. Do not delete an existing provider.
gcloud services enable \
  storage.googleapis.com iam.googleapis.com \
  cloudresourcemanager.googleapis.com sts.googleapis.com \
  iamcredentials.googleapis.com \
  --project="${INGEST_GCP_PROJECT:?Run step 1 first}" &&
gcloud iam workload-identity-pools create ingest \
  --project="${INGEST_GCP_PROJECT}" --location="global" &&
gcloud iam workload-identity-pools providers create-aws ingest-aws \
  --project="${INGEST_GCP_PROJECT}" --location="global" \
  --workload-identity-pool="ingest" \
  --account-id="<ingest-aws-account>" \
  --attribute-mapping="google.subject=assertion.arn,attribute.aws_role=assertion.arn.extract('assumed-role/{role_name}/')" \
  --attribute-condition="assertion.arn.startsWith('<ingest-role-sts-prefix>')"

3. Grant bucket access

  • After step 2 succeeds, run this. Both roles are required: Object Admin for files and Legacy Bucket Reader for bucket metadata. These grants cover the whole bucket, even though Ingest writes only inside your folder. A missing metadata grant can look like a missing bucket.
INGEST_GCP_NUMBER="$(gcloud projects describe "${INGEST_GCP_PROJECT:?Run step 1 first}" \
  --format='value(projectNumber)')" &&
INGEST_GCP_MEMBER="principalSet://iam.googleapis.com/projects/${INGEST_GCP_NUMBER}/locations/global/workloadIdentityPools/ingest/attribute.aws_role/<ingest-role-name>" &&
gcloud storage buckets add-iam-policy-binding "gs://${INGEST_GCS_BUCKET:?Run step 1 first}" \
  --member="${INGEST_GCP_MEMBER}" --role="roles/storage.objectAdmin" \
  --condition=None --project="${INGEST_GCP_PROJECT}" &&
gcloud storage buckets add-iam-policy-binding "gs://${INGEST_GCS_BUCKET}" \
  --member="${INGEST_GCP_MEMBER}" --role="roles/storage.legacyBucketReader" \
  --condition=None --project="${INGEST_GCP_PROJECT}" &&
printf '\nWorkload identity provider:\n//iam.googleapis.com/projects/%s/locations/global/workloadIdentityPools/ingest/providers/ingest-aws\n' "${INGEST_GCP_NUMBER}"
  • Paste the final output line into Workload identity provider at the bottom.
  • Leave Service account to impersonate (rarely needed) empty.

4. Test the connection

  • Click Test & configure at the bottom. Writes and reads temporary data, checks pipeline state, then attempts cleanup. Review any cleanup warning. If the test fails, fix the reported problem and choose Test again.

Staging

The worker writes files to your chosen bucket and prefix. No separate staging bucket is required.

Writes

Plain files cannot merge. Resources that require upserts need a table destination such as BigQuery. Contact Ingest to confirm a supported Iceberg setup if your data must remain in this bucket.

Conformance

Every adapter passes the same suite before it ships: create a table with every canonical type, append 100k rows, atomic replace, merge (latest dedup_sort wins; child tables delete-then-insert by root id), schema evolution, NULL-key rejection, package replay without duplicates, state and schema round-trip, row-count read-back, identifier edge cases, double-underscored table names (__quarantine, child tables), and rollback on a mid-load failure. Google Cloud Storage's badge reflects that suite run against a real bucket over federation, not against a stand-in.

Questions

Can Ingest load data into Google Cloud Storage?
Yes. Google Cloud Storage is live on Ingest's hosted service: the adapter passes all 15 conformance cases against the real service, and the setup steps are on this page.
Does Ingest merge into Google Cloud Storage, or only append?
Google Cloud Storage appends and replaces; it does not merge. Plain files have no update in place, so a resource that needs merge is filtered out with a reason before a pipeline is created, rather than failing on its first run.
What does Ingest need to connect to Google Cloud Storage?
Bucket and folder and Workload identity provider. Secrets are entered in a form, never in a chat, and held in a secret store under your own path: only the key names ever reach Ingest's database.
Which sources can Ingest load into Google Cloud Storage?
Every connector Ingest has certified (Abilene TX 311, Albany NY 311, Ann Arbor MI 311, Anne Arundel County MD 311, Anthropic, Asana, Auburn WA 311, Aurora IL 311, Austin TX 311, Baltimore MD 311, Baton Rouge LA 311, Beaumont TX 311, Bellevue WA 311, Bellingham WA 311, Berkeley CA 311, Bethlehem PA 311, Bloomington IN 311, Boca Raton FL 311, Boston MA 311, Bridgeport CT 311, Brockton MA 311, Brookline MA 311, Buffalo NY 311, Burlington VT 311, Cambridge MA 311, Cambridge MA Open Data, Charleston County SC 311, Charlotte NC 311, Chula Vista CA 311, Cincinnati OH 311, Chicago IL 311, New York City NY 311, Clayton County GA 311, Cleveland OH 311, Cobb County GA 311, Columbus OH 311, Corona CA 311, Dallas TX 311, Davenport IA 311, Denver CO 311, Detroit MI 311, Elgin IL 311, Encinitas CA 311, Everett WA 311, Federal Way WA 311, Fort Lauderdale FL 311, Gilbert AZ 311, Google Ad Manager, Google Analytics 4, Greenwich CT 311, Hartford CT 311, Honolulu HI 311, Houston TX 311, Howard County MD 311, Huntington WV 311, Huntsville AL 311, Indianapolis IN 311, Jersey City NJ 311, Jira, Kansas City MO 311, Kent WA 311, Knox County TN 311, Los Angeles CA 311, Lexington KY 311, Lincoln NE 311, LinkedIn Ads, Livonia MI 311, Louisville KY 311, Lubbock TX 311, Macon-Bibb County GA 311, Manchester NH 311, Maui County HI 311, Medford MA 311, Memphis TN 311, Miami FL 311, Miami-Dade County FL 311, Minneapolis MN 311, Montgomery County MD 311, Multnomah County OR 311, Naperville IL 311, Nashua NH 311, Nashville TN 311, Newark NJ 311, NOAA, New Orleans LA 311, Norfolk VA 311, Oakland CA 311, Omaha NE 311, Open Brewery DB, Paterson NJ 311, Peoria IL 311, Philadelphia PA 311, Pinellas County FL 311, Pittsburgh PA 311, PokéAPI, Portland ME 311, PostgreSQL, Prince George's County MD 311, Provo UT 311, Raleigh NC 311, Ramp, Renton WA 311, The Rick and Morty API, Sacramento CA 311, Salesforce, San Antonio TX 311, San Francisco CA 311, San Gabriel CA 311, San Jose CA 311, San Mateo County CA 311, San Rafael CA 311, Santa Fe NM 311, Scottsdale AZ 311, Seattle WA 311, Shopify, Somerville MA 311, Springfield MO 311, St. Petersburg FL 311, Tacoma WA 311, Toledo OH 311, Topeka KS 311, Vallejo CA 311, Washington DC 311, Wayne County MI 311, West Des Moines IA 311, Wichita KS 311, Worcester MA 311 and Youngstown OH 311), plus any API it authors on request. The data lands in a destination you own, under credentials you control. Ingest keeps no copy of it.

Sources certified against a real API today: Abilene TX 311, Albany NY 311, Ann Arbor MI 311, Anne Arundel County MD 311, Anthropic, Asana, Auburn WA 311, Aurora IL 311, Austin TX 311, Baltimore MD 311, Baton Rouge LA 311, Beaumont TX 311, Bellevue WA 311, Bellingham WA 311, Berkeley CA 311, Bethlehem PA 311, Bloomington IN 311, Boca Raton FL 311, Boston MA 311, Bridgeport CT 311, Brockton MA 311, Brookline MA 311, Buffalo NY 311, Burlington VT 311, Cambridge MA 311, Cambridge MA Open Data, Charleston County SC 311, Charlotte NC 311, Chula Vista CA 311, Cincinnati OH 311, Chicago IL 311, New York City NY 311, Clayton County GA 311, Cleveland OH 311, Cobb County GA 311, Columbus OH 311, Corona CA 311, Dallas TX 311, Davenport IA 311, Denver CO 311, Detroit MI 311, Elgin IL 311, Encinitas CA 311, Everett WA 311, Federal Way WA 311, Fort Lauderdale FL 311, Gilbert AZ 311, Google Ad Manager, Google Analytics 4, Greenwich CT 311, Hartford CT 311, Honolulu HI 311, Houston TX 311, Howard County MD 311, Huntington WV 311, Huntsville AL 311, Indianapolis IN 311, Jersey City NJ 311, Jira, Kansas City MO 311, Kent WA 311, Knox County TN 311, Los Angeles CA 311, Lexington KY 311, Lincoln NE 311, LinkedIn Ads, Livonia MI 311, Louisville KY 311, Lubbock TX 311, Macon-Bibb County GA 311, Manchester NH 311, Maui County HI 311, Medford MA 311, Memphis TN 311, Miami FL 311, Miami-Dade County FL 311, Minneapolis MN 311, Montgomery County MD 311, Multnomah County OR 311, Naperville IL 311, Nashua NH 311, Nashville TN 311, Newark NJ 311, NOAA, New Orleans LA 311, Norfolk VA 311, Oakland CA 311, Omaha NE 311, Open Brewery DB, Paterson NJ 311, Peoria IL 311, Philadelphia PA 311, Pinellas County FL 311, Pittsburgh PA 311, PokéAPI, Portland ME 311, PostgreSQL, Prince George's County MD 311, Provo UT 311, Raleigh NC 311, Ramp, Renton WA 311, The Rick and Morty API, Sacramento CA 311, Salesforce, San Antonio TX 311, San Francisco CA 311, San Gabriel CA 311, San Jose CA 311, San Mateo County CA 311, San Rafael CA 311, Santa Fe NM 311, Scottsdale AZ 311, Seattle WA 311, Shopify, Somerville MA 311, Springfield MO 311, St. Petersburg FL 311, Tacoma WA 311, Toledo OH 311, Topeka KS 311, Vallejo CA 311, Washington DC 311, Wayne County MI 311, West Des Moines IA 311, Wichita KS 311, Worcester MA 311, Youngstown OH 311.

Other destinations Ingest writes to: Amazon S3, Azure Blob Storage, Apache Iceberg, Ingest Managed Lakehouse, MotherDuck, Postgres, Amazon Athena, Databricks, Redshift, BigQuery, ClickHouse, MySQL / generic SQL, Snowflake.

Get your API data into Google Cloud Storage